Skip to content

Conversation

sy-records
Copy link
Member

@sy-records sy-records commented Jul 31, 2025

Summary

  • Searching with ?s= may trigger an XSS injection, escape the search str.
  • Introduce function stripUrlExceptId to ensure sidebar links only contains id as anchor.
    As-is

v4

image-v4

v5 rc1

image-v5rc1

Related issue, if any:

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • Documentation content changes
  • Other (please describe):

For any code change,

  • Related documentation has been updated, if needed
  • Related tests have been added or updated, if needed

Does this PR introduce a breaking change?

  • Yes
  • No

Tested in the following browsers:

  • Chrome
  • Firefox
  • Safari
  • Edge
Copy link

vercel bot commented Jul 31, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
docsify-preview ✅ Ready (Inspect) Visit Preview 💬 Add feedback Aug 6, 2025 3:03am
@Koooooo-7
Copy link
Member

Could u provide more details on this? for the security, we could discuss on chat confidentially in discord.

@Koooooo-7 Koooooo-7 changed the title fix: escape HTML in search keywords fix: escape HTML in search keywords and trim sidebar id Aug 6, 2025
@sy-records sy-records merged commit 743e9cb into docsifyjs:develop Aug 7, 2025
8 checks passed
@sy-records sy-records deleted the fix/search branch August 7, 2025 02:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants